CVE-2024-52577: Critical Deserialization Flaw in Apache Ignite

CVE-2024-52577 is a critical severity (CVSS 9.0) deserialization flaw in Apache Ignite from 2.6.0 up to, but not including, 2.17.0. Configured class serialization filters are ignored for some endpoints, so a crafted message could lead to code execution on the server. Upgrade to 2.17.0 or later.

What's affected

The record says Apache Ignite versions from 2.6.0 and before 2.17.0 are affected. The fixed release is 2.17.0.

The Apache advisory describes the condition: configured class serialization filters are ignored for some Ignite endpoints. An attacker would have to send a crafted Ignite message that contains an object whose class is present on the Ignite server classpath.

That last point matters. The risk depends on what else is on the classpath of the server. A lean deployment is harder to abuse than one packed with libraries.

How to check if you're exposed

Find the Ignite version on each node.

./bin/ignite.sh --version
find / -name "ignite-core-*.jar" 2>/dev/null

For an application that embeds Ignite, check the dependency tree.

mvn dependency:tree | grep -i ignite

Any version from 2.6.0 up to 2.16.x is affected. Also check how the cluster is exposed: Ignite server and thin client ports should not be reachable from untrusted networks.

What to do now

1. Find all Ignite clusters and embedding applications and note their versions.
2. Upgrade to 2.17.0 or later and test the cluster behaviour.
3. Restrict the Ignite ports so only cluster members and known clients can connect.
4. Review the serialization filter configuration you rely on, and keep the server classpath small.
5. Turn on authentication and TLS for Ignite connections where your deployment allows it.

Why it matters

The weakness is CWE-502 (Deserialization of Untrusted Data). A server that turns incoming bytes into live objects can be made to run code if an attacker can choose the object types. Serialization filters exist to block that, with a list of classes that may be loaded. Here the filter was not applied on some endpoints, so the protection that operators believed they had was missing.

The lesson is wider than Ignite. A security control that is configured but not enforced everywhere is worse than none, because it creates false confidence. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-52577.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Apache mailing list announcement (listed in the NVD record)
• oss-security post (listed in the NVD record)
• Gold entry for CVE-2024-52577

Last reviewed: 19 October 2026.